In the Linux kernel, the vti6_tnl_lookup() routine incorrectly falls back to wildcard tunnels without verifying their wildcard status. This flaw causes hash collisions and can result in packets being matched to the wrong VTI tunnel, potentially leading to misrouting of traffic or denial of service.

Linux kernel builds that include the unpatched ip6_vti module are affected. All distributions that run such kernel versions require an update to incorporate the fix.

The CVSS score is not publicly available, and the EPSS score is missing, so the exact exploitation likelihood cannot be quantified. The vulnerability involves internal kernel logic, suggesting that a local or kernel-level attacker would need to craft specific IPv6 packets that trigger the faulty lookup. Because the fix addresses a hash collision bug rather than an obvious privilege escalation path, exposure is likely limited but still warrants prompt patching. The vulnerability is not listed in the CISA KEV catalog.